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The MAILING DATE of this communication appears on the cover sheet with the correspondence address 
Period for Reply 



A SHORTENED STATUTORY PERIOD FOR REPLY IS SET TO EXPIRE 3 MONTH(S) FROM 
THE MAILING DATE OF THIS COMMUNICATION. 

- Extensions of time may be available under the provisions of 37 CFR 1 .136(a). In no event, however, may a reply be timely filed 
after SIX (6) MONTHS from the mailing date of this communication. 

- If the period for reply specified above is less than thirty (30) days, a reply within the statutory minimum of thirty (30) days will be considered timely. 

- If NO period for reply is specified above, the maximum statutory period will apply and will expire SIX (6) MONTHS from the mailing date of this communication. 

- Failure to reply within the set or extended period for reply will, by statute, cause the application to become ABANDONED (35 U.S.C. § 1 33). 
Any reply received by the Office later than three months after the mailing date of this communication, even if timely filed, may reduce any 
earned patent term adjustment. See 37 CFR 1.704(b). 

Status 

1 )[3 Responsive to communication(s) filed on 10/19/00 . 
2a)D This action is FINAL. 2b)IEI This action is non-final. 

3) D Since this application is in condition for allowance except for formal matters, prosecution as to the merits is 

closed in accordance with the practice under Ex parte Quayle, 1935 CD. 1 1 , 453 O.G. 213. 

Disposition of Claims 

4) E3 Claim(s) 1-33 is/are pending in the application. 

4a) Of the above claim(s) is/are withdrawn from consideration. 

5) D Claim(s) is/are allowed. 

6) [3 Claim(s) 1-33 is/are rejected. 

7) D Claim(s) is/are objected to. 

8) D Claim(s) are subject to restriction and/or election requirement. 

Application Papers 

9) D The specification is objected to by the Examiner. 

10)D The drawing(s) filed on is/are: a)D accepted or b)D objected to by the Examiner. 

Applicant may not request that any objection to the drawing(s) be held in abeyance. See 37 CFR 1 .85(a). 

Replacement drawing sheet(s) including the correction is required if the drawing(s) is objected to. See 37 CFR 1 .121(d). 
1 !)□ The oath or declaration is objected to by the Examiner. Note the attached Office Action or form PTO-152. 

Priority under 35 U.S.C. § 119 

12)D Acknowledgment is made of a claim for foreign priority under 35 U.S.C. § 119(a)-(d) or (f). 
a)D All b)Q Some * c)D None of: 

1 .□ Certified copies of the priority documents have been received. 

2. n Certified copies of the priority documents have been received in Application No. . 

3. Q Copies of the certified copies of the priority documents have been received in this National Stage 

application from the International Bureau (PCT Rule 17.2(a)). 
* See the attached detailed Office action for a list of the certified copies not received. 
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DETAILED ACTION 



Drawings 

1. New corrected drawings are required in this application because Figures 1-4A 
have handwriting labels. The requirement for corrected drawings will not be held 
in abeyance. 



Claim Rejections - 35 USC §112 



2. The following is a quotation of the second paragraph of 35 U.S.C. 1 12: 

The specification shall conclude with one or more claims particularly pointing out and distinctly 
claiming the subject matter which the applicant regards as his invention. 

Claims 9 and 10 recite the limitation "sequence number" in claim 8. There is 

insufficient antecedent basis for this limitation in the claim. Examiner will assume that 

the inventor referring the "sequence number" claimed in claim 2. Otherwise, applicant 

needs to provide appropriate correction. 



Claim Rejections - 35 USC § 102 

3. The following is a quotation of the appropriate paragraphs of 35 U.S.C. 102 that 
form the basis for the rejections under this section made in this Office action: 
A person shall be entitled to a patent unless - 

(e) the invention was described in (1) an application for patent, published under section 122(b), by 
another filed in the United States before the invention by the applicant for patent or (2) a patent 
granted on an application for patent by another filed in the United States before the invention by the 
applicant for patent, except that an international application filed under the treaty defined in section 
351(a) shall have the effects for purposes of this subsection of an application filed in the United States 
only if the international application designated the United States and was published under Article 21(2) 
of such treaty in the English language. 
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4. Claims 1-2, 6-14, 16-19, and 23-31 are rejected under 35 U.S.C. 102(e) as 
being anticipated by Dietz et al (US/6651099). 

5. As per claim 1 , Dietz et al disclose a method for providing a unique identification 
of monitored network data instances flowing across various connections between 
networked devices, the unique identification being derived from information 
contained entirely within each instance of the network data, the method 
comprising: using at least one monitoring device to monitor a network data 
instance flowing across at least one data connection (Col 8 line 64 and Fig 1 ); 
deriving from the data instance certain information which collectively provides a 
unique identification (Col 13 lines 20-22) of the network data instance; 
assembling the derived information into an input string for a hash function (Col 13 
lines 1-29); and using the output string of the hash function as a signature which 
represents a unique identifier of the network data instance (Col 13 lines 30-36). 



6. As per claims 2 and 19, Dietz et al disclose the method according to Claims 1 
and 18, wherein the deriving step includes: deriving from the data instance a 
source and destination address for the data (Col 9 lines 58-67 and Col 10 lines 1- 
7); deriving from the data instance a source and destination port associated with 
the networked devices (Col 10 lines 8-22); deriving from the data instance at 
least one sequence number associated with data instance (Col 13 lines 30-33). 
The hash output string is the sequence number. 
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7. As per claims 6 and 23, Dietz et al disclose the method according to Claims 1 
and 18, wherein network data instances are data packets as part of a TCP/IP 
(Transmission Control Protocol/Internet Protocol) client-server network (Col 8 
lines 57-67). 

8. As per claims 7 and 24, Dietz et al disclose the method according to Claims 6 
and 23, wherein the source and destination addresses include a client IP address 
and a server IP address. The source and destination addresses include a client 
IP address and a server IP address is inherent in a TCP/IP network. It is well 
known in the art that the IP data packet has the source and destination address 
in the header. 

9. As per claims 8 and 25, Dietz et al disclose the method according to Clams 7 
and 24, wherein the source and destination port of a client port number and a 
server port number is also inherent in a TCP/IP network. It is well known in the 
art that the IP data packet has the source and destination ports associate to the 
protocol in the header. 

10- As per claims 9 and 26, Dietz et al disclose the method according to Claims 2, 
wherein the at least one sequence number includes a client sequence number or 
a server sequence number (Col 12 lines 13-22). It is well know in the art that the 
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protocol type associates with a port number of the source and destination, which 
is interpreted a sequence number. 

11. As per claims 10 and 27, Dietz et al disclose the method according to Claims 9 
and 26, wherein the at least one sequence number includes both a client 
sequence number and a server sequence number (Col 12 lines 13-22). It is well 
known in the art that the protocol type associates with a port number of the 
source and destination, which is interpreted a sequence number. 

12. As per claims 11 and 28, Dietz et al disclose the method according to Claims 2 
and 19, wherein the input string information does not include sequence numbers. 
The input string is the length of the header (Col 13 lines 3-4) and the sequence 
number is the port number associated to the protocol communication between 
the client and the server (Col 12 lines 13-22). 

13. As per claims 12 and 29, Dietz et al disclose the method according to Claims 1 1 
and 28, wherein the network data instances are datagrams as part of a UDP/IP 
(User Datagram Protocol/Internet Protocol) network (Col 9 line 44). 

14. As per claims 13 and 30, Dietz et al disclose the method according to Claims 1 
and 18, which further includes: truncating the signature to include fewer bits than 
the hash function output string (Col 17 line 13 and lines 7-19). 
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15. As per claims 14 and 31, Dietz et al disclose the method according to Claims 1 
and 18, which further includes: adding flag bits to the signature which indicate the 
type of application associated with the network data instance (Col 17 line 47 and 
lines 29-47). 

16. As per claim 16, Dietz et al disclose the method according to Claim 1 , wherein 
the monitoring device operates to directly monitor the network data (108, Fig 1) 

17. As per claim 17, Dietz et al disclose the method according to Claim 1 , wherein 
the monitoring device operates to indirectly monitor the network data (Col 28 
lines 56-64). SNMP is used to send the network data of the device to the packet 
acquisition device of the monitor. 

18. As per claim 18, Dietz et al disclose an apparatus for providing a unique 
identification of monitored network data instances flowing across various 
connections between networked devices, the unique identification being derived 
from information contained entirely within each instance of the network data, the 
apparatus comprising: at least one monitoring device positioned to monitor a 
network data instance flowing across at least one data connection (Col 8 line 64 
and Fig 1); a hash function device having an input string and an output string, the 
input string assembled from certain information derived from the network data 
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instance, the information collectively providing a unique identification of the 
network data instance; wherein the output string is used as a signature which 
represents a unique identifier of the network data instance. 



Claim Rejections - 35 USC § 103 

The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set 
forth in section 102 of this title, if the differences between the subject matter sought to be patented and 
the prior art are such that the subject matter as a whole would have been obvious at the time the 
invention was made to a person having ordinary skill in the art to which said subject matter pertains. 
Patentability shall not be negatived by the manner in which the invention was made. 

21. Claims 3-5, 15, 20-22, 32, and 33 are rejected under 35 U.S.C. 103(a) as being 
unpatentable over Dietz et al (US-6651099). 

22. As per claims 3, 4, 20, and 21 , Dietz et al disclose the method according to 
Claims 1 and 18, which further includes: attaching the signature to at least one 
data report associated with the network data instance (Col 20 lines 40-60); 
However, Dietz et al do not disclose the transmitting data reports and signatures 
from each monitoring device to a central collecting device. Nevertheless, Dietz 
et al do teach the monitor the device being part of a network (Fig 1), which is 
capable to transmit and receive data from any workstations or network devices. 



19. 



20. 
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It is obvious to one ordinary skill in the art at the time the invention was made 
that data transmitting from remote device to a central collecting and well know in 
the art. 



23. As per claims 5 and 22, Dietz et al disclose the method according to Claims 3 
and 20. However, Dietz et al do not mention the central collecting device uses 
the signatures to eliminate duplicate data reports that might come in from 
different monitoring devices positioned at different locations on the network. 
Nevertheless, this feature is obvious to one ordinary skill in the art at the time the 
invention was made to recognize that the data reports coming from different 
devices will have different signatures, since the signature is composing of 
protocol, ip addresses of the source and destination (Col 13 lines 30-35). 



24. As per claims 15 and 32, Dietz et al disclose the method according to Claims 3 
and 20. However, Dietz et al do not mention the monitor serves as a data 
reduction device for data report and signature information being sent to the 
central data collector. Nevertheless, Dietz et al do teach the input string 
truncation to reduce the signature (Claim 13) (Col 17 line 13 and lines 7-19). It is 
obvious to one ordinary skill in the art at the time the invention was made to 
recognize that the monitor device can also be the data reduction device for the 
data report and signature. 
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25. As per claim 33, Dietz et al disclose method for providing a unique signature of 
monitored network data packets flowing across various connections between 
networked devices, the unique signature being derived from information 
contained entirely within each instance of the network data packet, the method 
comprising: using at least one monitoring device to monitor a network data 
packet flowing across at least one data connection (Col 8 line 64 and Fig 1 ); 
deriving from the data packet a source and destination address for the data is 
inherent in a TCP/IP network; deriving from the data packet a source and 
destination port associated with the networked devices is inherent in a TCP/IP 
network; deriving from the data packet at least one sequence number associated 
with data instance (Col 13 lines 28-29); assembling the derived addresses, ports, 
and at least one sequence number information into an input string for a hash 
function (Col 13 lines 20-29); and using the output string of the hash function as 
the signature which represents a unique identifier of the network data packet (Col 
13 lines 30-35); attaching the signature to at least one data report associated 
with the network data packet (Col 20 lines 40-60); and Since the statistical 
information is stored in a database, the transmitting the data reports and 
signatures from each monitoring device to a central collecting device for analysis 
is well known in the art. Transmitting information from numerous devices to a 
central collector is well known. It is obvious to one ordinary skill in the art at the 
time the invention was made to know that that the IP data packet has the source 
and destination address in the header, the IP data packet has the source and 
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destination ports associate to the protocol in the header, and transmits 
information from numerous devices to a central collect. 



Conclusion 

26. The prior art made of record and not relied upon is considered pertinent to 
applicant's disclosure. 

27. Any inquiry concerning this communication from the examiner should be directed 
to Linh Son whose telephone number is (703)-305-8914. 

28. If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor Kim Y. Vu can be reached at (703)-305-4393. The fax numbers for 
this group are (703)-872-9306 (official fax). Any inquiry of general nature or 
relating to the status of this application or proceeding should be directed to the 
group receptionist whose telephone number is (703)-305-9600. 



Linh LD Son 
Patent Examiner 



